[ad_1]
A United States An Immigration and Customs Enforcement database obtained by WIRED through a Freedom of Information Act request shows the agency has been relying on limited administrative subpoenas to collect information from elementary schools, abortion clinics and other vulnerable populations. And new details about the recent supply chain attack on VoIP software 3CX suggest that attackers — possibly hackers working for the North Korean government — targeted cryptocurrency companies in the broader attack.
We also looked at the move by Italy’s data regulator Garante per la Protezione dei Dati Personali this week to temporarily stop OpenAI from injecting Italian personal data into training data. In response, the company currently blocks people in Italy from accessing its generative AI platform, ChatGPT. Meanwhile, we examine the dangerous lack of security in America’s agricultural sector and the nation’s food supply chain, and delve into the saga of a small American gadget blog that discovered serious flaws in foreign security cameras and took on China’s spy industry. Fix them.
In virtual private network news, open source VPN Amnezia is allowing users in Russia to stay one step ahead of the Kremlin’s inveterate censorship and digital surveillance. And the Tor Project has partnered with open-source VPN maker Mulvad to create a new privacy-focused browser that includes the VPN of your choice.
Plus, there’s more. Each week, we round up security news that we haven’t covered in depth ourselves. Click on headlines to read full stories and stay safe there.
Chinese ecommerce giant Pindoduo has more than 750 million customers per month and sells a huge variety of products and merchandise. But cybersecurity researchers who analyzed the company’s Android app found that it was full of invasive malware that used Android vulnerabilities to take control of users’ devices—getting information from other apps, changing system settings, and controlling people’s digital activity in a number of ways.
Current and former PinDuoDuo employees told CNN that the company has a distinct motive for finding Android vulnerabilities and developing exploits. The aim is said to be to increase sales by monitoring customers and competitors. CNN said there was no specific evidence that Pinduodu would pass on the stolen information to Beijing, but that it was highly possible under Chinese law. Google banned the app from the Play Store at the end of March, but the app store is banned in China, so Android users download their apps from local app stores anyway. In the past, Pindoduo denied the speculation and allegations [the] The Pinduoduo app is malicious, but CNN did not respond to multiple requests for comment on the new findings. Tech giants around the world are often criticized for their massive and excessive data collection practices. But researchers say Pinduo Duo’s app is particularly nasty.
Law enforcement agencies from 17 states joined forces this week to take down Genesis, a widely used digital criminal marketplace, which was hacked with large amounts of stolen login credentials and access tokens. After the police seized the site’s infrastructure, they launched a massive operation in several countries to conduct 208 property searches and arrest 119 of the site’s users. The FBI and the Dutch National Police led the effort, with support from Europol and many others. United States Attorney General Merrick Garland said, “Working with our 45 FBI field offices and our international partners, the Department of Justice has begun an unprecedented takedown of a massive criminal marketplace that has allowed cybercriminals to prey on individuals, businesses and governments around the world.” In the statement. “Our seizure of Genesis Marketplace should serve as a warning to cybercriminals who operate or exploit these criminal marketplaces.”
Just before tax day, public procurement records reviewed by Motherboard show that the US Internal Revenue Service is interested in buying Internet monitoring equipment from Cymru, a company that makes digital surveillance products. The FBI and the US military are already customers. The tool provides users with “netflow” data that shows a wide range of internet activity, including interactions such as server connections. Without such surveillance tools, only the server’s host or operator and Internet service provider can access such information. The filings indicate that the IRS wants to buy several cybersecurity products for defense.
Tesla vehicles include multiple cameras, but the video they capture is supposed to be locked so you can have privacy in your own car. However, Tesla employees shared embarrassing and “extremely invasive” videos and images from customers’ cars on an internal company forum between 2019 and 2022, according to Reuters. Some of the images were just of dogs or funny road signs, but he also filmed dangerous situations including nudity. Tesla did not respond to detailed questions from Reuters about the findings.
The Chinese spy balloon that caused chaos when it floated over the US earlier this year made several passes over sensitive military sites and successfully collected some electronic signals from communications and equipment, three current and former officials told NBC. News. The US government said at the time that it was taking steps to prevent the balloon from collecting valuable material. The three officials added that the U.S. countermeasures have succeeded in greatly reducing the amount of data the balloon could collect.
[ad_2]
Source link